CVE-2017-3743

🗓️ 20 Jun 2017 00:00:00Reported by lenovoType

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2017-3743	20 Jun 201700:00	–	cvelist
EUVD	EUVD-2017-12860	7 Oct 202500:30	–	euvd
Lenovo	Credentials sent through the Lenovo ToolsCenter may be exposed to local users - us	8 Jun 201700:00	–	lenovo
NVD	CVE-2017-3743	20 Jun 201700:29	–	nvd
OSV	CVE-2017-3743	20 Jun 201700:29	–	osv
Prion	Command injection	20 Jun 201700:29	–	prion

NVD

Vulners

Node

lenovo advanced_settings_utilityRange≤10.1

lenovo toolscenter_dynamic_system_analysisRange≤10.2

lenovo updatexpress_system_pack_installerRange≤10.2

[
  {
    "product": "ToolsCenter",
    "vendor": "Lenovo Group Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Lenovo Advanced Settings Utility versions earlier than 10.2 and UXSPI and DSA versions earlier than 10.3"
      }
    ]
  }
]

Source	Link
support	www.support.lenovo.com/us/en/product_security/LEN-10810

13 May 2026 00:24Current

7.6High risk

Vulners AI Score7.6

CVSS 23.5

CVSS 37.5

EPSS0.00354

CWE-200